CISO Insights: Voices in Cybersecurity

Even when attackers successfully impersonate executives or hijack legitimate communication accounts, robust procedural controls can halt unauthorized transactions. Dual authorization mandates that high-risk actions—such as modifying supplier bank accounts or executing large wire transfers—require independent approval from two separate personnel. This episode provides step-by-...

Modern infostealers bypass initial multi-factor authentication by stealing active browser session cookies, allowing adversaries to hijack authenticated cloud sessions. To neutralize session theft, emerging standards like Device Bound Session Credentials (DBSC) cryptographically pair SaaS session tokens to the endpoint hardware's Trusted Platform Module (TPM). This episode exp...

While enterprise teams adopt AI tools to boost productivity, inserting corporate IP, customer PII, or proprietary code into unvetted public LLMs creates severe data leakage risks. Shadow AI risk management requires visibility into unauthorized AI tool usage without stifling employee efficiency or creativity. This episode establishes practical guidelines for local prompt scrub...

Machine identities—including API keys, service accounts, automated scripts, and AI agents—now outnumber human employees in enterprise environments by over ten to one. Threat actors increasingly target these non-human identities because they often possess elevated privileges without multi-factor authentication or session expiration constraints. This episode examines strategies...

As adversary-in-the-middle (AiTM) phishing kits routinely bypass SMS and push-based multi-factor authentication, enterprise security is pivoting toward cryptographic passkeys. Built on FIDO2 and WebAuthn standards, passkeys bind authentication directly to the official domain and hardware enclave, rendering credential harvesting impossible. This episode breaks down device-boun...